Critical Golden dMSA Attack in Windows Server 2025 Enables Cross-Domain Attacks and Persistent Access
Source: https://thehackernews.com/2025/07/critical-golden-dmsa-attack-in-windows.html
Attackers Hide JavaScript in SVG Images to Lure Users to Malicious Sites
Source: https://hackread.com/attackers-hide-javascript-svg-images-malicious-sites/
Deriv security team recently uncovered a macOS malware campaign targeting developers - using a fake Homebrew install script, a malicious Google ad, and a spoofed GitHub page.
Broken down in the blog
Worth a read.
I recently investigated a Red Bull-themed phishing campaign that bypassed all email protections and landed in user inboxes.
The attacker used trusted infrastructure via post.xero.com and Mailgun, a classic living off trusted sites tactic. SPF, DKIM and DMARC all passed. TLS certs were valid.
This campaign bypassed enterprise grade filters cleanly... By using advanced phishing email analysis including header analysis, JARM fingerprinting, infra mapping - we rolled out KQL detections to customers.
Key Takeway: No matter how good your phishing protections are, determined attackers will find ways around them. That's where a human-led analysis makes the difference.
Full write-up (with detailed analysis, KQL detections & IOCs)
https://evalian.co.uk/inside-a-red-bull-themed-recruitment-phishing-campaign/
Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously identified JavaScript-based [Interlock RAT](https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/) (aka [NodeSnake](https://www.quorumcyber.com/wp-content/uploads/2025/06/20250416-Higher-Education-Sector-RAT.pdf)), uses PHP and is being used in a widespread campaign.
McDonald’s AI Hiring Tool McHire Leaked Data of 64 Million Job Seekers
Source: https://hackread.com/mcdonalds-ai-hiring-tool-mchire-leaked-job-seekers-data/
A new variant of macOS.ZuRu malware has been discovered, targeting users through a trojanized version of the Termius app. This backdoor, initially noted in 2021, now uses a modified Khepri C2 framework for post-infection operations. The malware is delivered via a .dmg disk image containing a hacked version of Termius.app. It adds two executables to the embedded Termius Helper.app and uses a new method to trojanize legitimate applications. The malware installs persistence via a LaunchDaemon and includes an md5 updater mechanism. The payload obtained from the C2 is a modified Khepri beacon with capabilities for file transfer, system reconnaissance, and command execution. The threat actor continues to target developers and IT professionals, adapting their techniques to evade detection.
Android malware Anatsa infiltrates Google Play to target US banks
Source: https://www.bleepingcomputer.com/news/security/android-malware-anatsa-infiltrates-google-play-to-target-us-banks/
SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools
Source: https://thehackernews.com/2025/07/seo-poisoning-campaign-targets-8500.html
Google Warns: Critical Chrome Flaw Letting Hackers Take Over PCs Is Already Being Exploited
Source: https://techoreon.com/google-warns-critical-chrome-flaw-letting-hackers-take-over-pcs-is-already-being-exploited/
New FileFix attack runs JScript while bypassing Windows MoTW alerts
Source: https://www.bleepingcomputer.com/news/security/new-filefix-attack-runs-jscript-while-bypassing-windows-motw-alerts/
Scammers Use Microsoft 365 Direct Send to Spoof Emails Targeting over 70 US Firms
Source: https://hackread.com/scammers-microsoft-365-direct-spoof-emails-us-firms/
